Privacy Policy
The short version. We collect what we need to run Deskmate: your account details, the things you put in it, and (only if you connect them) your calendar and email data. We don't sell your data or use it for advertising. Card payments are handled by Stripe. Your assistant messages go to an AI provider so it can reply. You can export or delete your data and you have full UK GDPR rights.
1. Who is responsible for your data
The data controller is [YOUR FULL LEGAL NAME], trading as Deskmate, [POSTAL ADDRESS]. Contact: [PRIVACY EMAIL]. [If registered with the ICO, add: ICO registration number XXXXXXXX.]
2. What we collect and why
| Data | Why we use it | Legal basis (UK GDPR) |
|---|---|---|
| Account data: name, email, password (stored only as a secure hash), plan, sign-up date | Create and run your account, log you in, contact you about the Service | Contract |
| Your Content: tasks, lists, meal plans, calendar entries, meeting notes, settings | Provide the Service and sync it across your devices | Contract |
| Assistant messages and the context you or the app send with them (for example, the task titles it's asked to prioritise) | Generate responses and suggestions | Contract |
| Connected accounts (if you choose): Microsoft Outlook/Exchange mail and calendar, Apple Calendar. This includes access tokens and the email or event data we read to provide the feature you enabled (for example, finding deadlines in emails) | Provide the integrations you switch on | Contract / your consent. You can withdraw it by disconnecting |
| Trial and repeat-trial checks: a one-way scrambled (hashed) version of your email address, and of the address of any mailbox you connect to Deskmate, kept so we can recognise a repeat trial or the same mailbox on two accounts. The scrambled value can't be turned back into the address, and it is kept after you delete your account so that a trial can't simply be repeated | Stop the free trial being repeated, and keep one mailbox to one account | Legitimate interests (preventing abuse of the free trial) |
| Marketing choice: whether you ticked the box to get emails about your trial and Deskmate offers, when, and the wording you saw. If you unsubscribe, a scrambled version of your address is kept so we don't email you again | Send marketing emails only to people who asked for them, and honour unsubscribes | Consent (you can withdraw it at any time in Settings → Subscription, or with the unsubscribe link in any marketing email) |
| Billing data: Stripe customer ID, plan, payment status, card brand and last four digits, billing country, invoices. We do not receive or store your full card number | Take payments, refunds, tax records, resolve payment disputes, prevent fraud | Contract; legal obligation (tax and accounting records); legitimate interests (fraud prevention) |
| Usage and technical data: IP address, device/browser type, log entries, error reports, assistant usage counts | Keep the Service secure and working, enforce fair use, debug problems | Legitimate interests |
| Service emails we send you: a welcome email, a confirmation when a payment method is added (card brand and last four digits only), receipts after each payment, failed-payment and renewal notices, and trial-ending notices. Marketing emails are separate and only sent if you opted in | Run your account and your subscription, and tell you about changes to it | Contract; legal obligation (receipts) |
| Support messages you send us | Reply to you and keep a record of issues, including billing disputes | Contract; legitimate interests |
We don't knowingly collect special category data (such as health or religious data) on purpose, but because you can write anything in your notes, tasks or assistant messages, such data could end up there. We treat it as Your Content and only process it to provide the Service to you. Please avoid putting highly sensitive information into the assistant.
3. How email and calendar connections work
- These are opt-in. Nothing is connected unless you connect it.
- We request only the permissions needed for the features you use. [Check this matches your actual Microsoft Graph / CalDAV scopes and describe them here, e.g. "read-only access to your mail and calendar".]
- Email content is processed to identify things like deadlines and events. [State whether you store full emails or only extracted items. Recommended: only extracted items and message IDs.]
- You can disconnect at any time in Settings, and we'll delete the stored access tokens. Items already extracted into your Deskmate lists remain until you delete them.
- If the account belongs to a university or employer, your organisation's own rules and admin approvals still apply. We have no control over those.
4. The AI assistant and who sees your messages
- When you use the assistant, the text of your request and the context needed to answer it is sent to our AI provider, Groq, Inc., using a key held by us. Groq processes it to generate a response. We don't use your assistant messages to train models, and we only use providers whose terms we've reviewed. [Confirm against Groq's current data-retention and training terms before publishing.]
- For some accounts (administrators), the assistant runs on a language model hosted on our own server, so those messages don't go to a third-party AI provider.
- We keep assistant conversation history in your account so you can see past chats, and count usage to enforce fair use. You can delete conversations.
- AI replies are generated automatically. We don't use them to make legal or similarly significant decisions about you.
5. Who we share data with
We don't sell your personal data and we don't share it for advertising. We share it only with:
| Who | What for | Where |
|---|---|---|
| Stripe Payments Europe / Stripe, Inc. | Payment processing, fraud prevention, receipts | EU/UK and USA |
| Groq, Inc. | Generating AI assistant responses | USA |
| Microsoft / Apple | Only if you connect Outlook/Exchange or Apple Calendar | Various |
| Our hosting provider: [HOST NAME] | Hosting the app and database, backups | [COUNTRY] |
| Email delivery provider: [if you use one] | Sending account, billing and reminder emails | [COUNTRY] |
| Professional advisers, regulators, courts, banks and card schemes | Legal advice, complying with the law, responding to payment disputes or chargebacks | UK and elsewhere as needed |
If the business is ever sold or transferred, your data may transfer to the new owner, who must honour this policy, and we'd tell you first.
6. International transfers
Some providers above are based in or process data in the United States. Where we transfer personal data outside the UK, we rely on an adequacy arrangement (such as the UK–US data bridge for certified companies) or on the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, or another lawful mechanism. Ask us if you want details.
7. How long we keep data
| Data | Kept for |
|---|---|
| Account data and Your Content | While your account is open. Moving from Autopilot Plus to the free Desk tier does not delete anything. If you delete your account yourself it is deleted immediately. If we close your account (for example for a serious breach of our terms), your data is kept for 60 days in case that was a mistake, then deleted. Backups made by our host clear within a further 30 days. |
| Billing records (invoices, payment and refund records) | 6 years after the relevant tax year, as required for tax and accounting |
| Payment dispute and support records | 6 years after the dispute is closed (the standard limitation period for contract claims in England and Wales) |
| Server logs and security logs | Up to 90 days, then deleted automatically |
| Connected account tokens | Until you disconnect or close your account |
8. Your rights
Under UK data protection law you have the right to: be informed; access your data; correct it; delete it; restrict or object to processing based on legitimate interests; data portability (a machine-readable export); and withdraw consent where we rely on it. You also have rights relating to automated decision-making, though we don't do any that has legal or similarly significant effects.
To use these rights, email [PRIVACY EMAIL] or use Settings → Your data & account to download all your data or delete your account yourself. We respond within one month, free of charge. We may need to verify your identity first. Some data we must keep by law (like billing records) and we'll tell you if that applies. When you delete your account we keep only a minimal billing record (your email, name, dates, plan and payment references, no content) for 6 years, then delete it.
Complaints. Please contact us first so we can try to put things right. You also have the right to complain to the UK Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
9. Security
We use measures such as encrypted connections (HTTPS), hashed passwords, encryption of what you write (task, list, note, calendar, contact and email-suggestion text and attached file names) in our database (AES-256), stored with the key kept separately from the database, access controls and regular updates. No online service is perfectly secure, so please use a strong, unique password. If a breach seriously affects you, we'll tell you and the ICO as the law requires.
10. Children
Deskmate is for people aged 16 and over. We don't knowingly collect data from younger children. If you believe a child has an account, tell us and we'll delete it.
11. Cookies
We use a small number of essential cookies. See our Cookie Policy.
12. Changes
We'll update this policy when our practices change. We'll tell you about significant changes by email or in the app before they take effect. The date at the top shows when it was last updated.
13. Contact
[PRIVACY EMAIL] · [POSTAL ADDRESS]